In multi-tenant database systems, customer organizations (also referred to as “tenants”) may share database resources in one logical database. The databases themselves are typically shared, and each tenant is typically associated with an organization identifier (org ID) column or field that may be used to identify rows or records belonging to each tenant. Each tenant may provide their own custom data, which may include defining custom objects and custom fields, as well as designating one or more custom fields to act as custom index fields. Users of a multi-tenant database system (e.g., a tenant/organization (org) or developers associated with the tenant) may develop applications or platforms that interact or integrate with the multi-tenant database system and utilize data from an associated tenant space. The applications/platforms may obtain data from the associated tenant space to render/display visual representations of relevant tenant data. Systems to provide services (e.g., web services) may experience service degradation or disruption. The cause of such service disruptions may be one or more users that consume large amounts of resources relative to other users, such as by flooding the system with numerous calls or requests. In order to mitigate these service disruptions, some service providers (e.g., web service providers) may attempt to detect or identify client devices that are causing service disruptions, and that suspend the offending client devices from using the disrupted services.